Custom ignition/alarm/immobolizer system

**PredatorCoder** · 04-04-2006, 11:11 PM

OK this all started from my intent to (1) provide stable 12V power source to car PC electronics, even when cranking, and (2) secure the car as much as possible from theft. Well it's gotten a little bigger, let me know what you think! I've almost got a Computer Science degree /w emphasis on embedded systems, and I've been programming for years... so I'm confident I can handle it (just a matter of time).

Firstly, security:

1. A lot of people like to put a relay or switch on the line to the fuel pump. What a great idea, except if I find your switch you are defeated. (OK maybe unlikely, but I like a challenge). My idea is put relays on multiple lines (fuel pump, ignition, crank, injectors). Obviously this has to be kept somewhat within reason due to power consumption of closed relays, but you get the point. The key point here is that I will put the relay on a small PCB along with a tiny microcontroller (remember that this is all *at the location of the relay*). The microcontroller will *only* close the relay whenever it receives the right password via 2-wire serial protocol. Thus, we have a (hopefully) secure relay that cannot be bypassed by poking around with the control wires. (E.g. suppose the thief found the "brain" of my security system - he can't just then connect each relay wire to GND or 12V and expect to close any relays). But of course there's a limit: closed relays take ~170 mA current and you don't want to suck down 2A of your electrical system just from relays!

2. Continuing with #1: if you are trying to cut off a wire that carries < 1 A of current, it is easy to cut it off using solid state (e.g. analog switch, transistor). Still use the same microcontroller scheme as #1 though. So for example, you could use it to turn off critical sensors to the ECM (e.g. MAP, crankshaft position I have been told by a couple people can be turned off without engine damage - please correct me if wrong!) Also the ECM controls some relays (e.g. main relay) - these control wires could be disabled through solid state switches as well. The nice thing is that it could all fit on a small PCB and be well-hidden inside the ECM box - only the two data wires would come out of the ECM - nobody will suspect that, right? Only way to bypass that is disassemble the ECM I would think.

3. The secure relays/switches described above will feed into a power and ignition controller/monitor board. Will have the following features/setup:
(a) Note that this board will be powered off a small 12V rechargable battery (lest the thief disconnect the main car battery).
(b) The existing ignition key wiring of the car will be ripped out (along with the steering wheel lock - unless somebody has a brilliant idea here how to retain it safely). The ignition key will instead function as an input switch to the microcontroller.
(c) The microcontroller will then close the appropriate secure relays to start the car. It will also open/close a relay to the tank battery that runs the car PC, to ensure that the main car battery does not go dead charging the tank (e.g. car PC does not shut off properly). This will all be triggered by the ignition key switch above, or by an external I/O source (e.g. the security module).
(d) Microcontroller will have a few external voltage sense pins to monitor the voltage on the main electrical system, its own backup battery, and the car PC tank battery.
(e) Microcontroller will have plugs for hooking up external ammeters, which will monitor current flowing through (1) primary car battery, (2) alternator, (3) car PC tank battery, (4) anything else I feel like monitoring.
(f) Microcontroller will have a couple external pins which will "press" the power button on one or more car PCs to turn them on.
(g) Microcontroller will have a USB connection. It will look like a standard ACPI-compliant battery - so your Windows box will show the standard "plugged in" power icon when the car is on, and an "on battery" icon with appropriate percentage when car is off (and critically, you can set a 1 minute "hibernate" timeout if the PC goes on battery - this handles the shutdown problem). Additionally the voltage/current sensors can be read through the USB, for example for a PC-based heads-up display. Note that USB will tell you if the car is on/off, but won't allow the PC to actually start/stop the car.

4. Eventually I'll make a separate security module to replace the ignition key completely. This module will communicate with the above power module and have:
(a) keypad and LCD for inputting a PIN number to start the car - this replaces the ignition key completely (e.g. I could throw away my key). Another keypad will be hooked up, which will be mounted on door handles.
(b) port for GPS, to track vehicle position (GPS will have dead-reckoning in case signal goes bad).
(c) port for dedicated prepaid cell phone, to send text message if alarm goes off, and send GPS coordinates (that's going to be my alarm's pager!).
(d) microphone and hookup to car amplifier, to communicate with thief via cell phone (or just listen to his activities)
(e) an array of theft-sensors (accelerometer, glass, door, hood, trunk, motion)
(f) sirens
(g) get the car PC going to start some security cameras (recorded into a CompactFlash card hidden deep within car - think of it as a black box).
(h) USB port to read any data that is logged - e.g. a record of alarms going off, which sensors were tampered with, etc.

OK sure this is overkill for a 97 Civic.

But it will be fun. What do you guys think?

**piabu** · 04-04-2006, 11:21 PM

Wow! That sounds complicated.

What happens if something in the system breaks? Would that leave you stranded?

I use a much simpler security solution. I drive a crappy old much-dented ****box with sun-damaged paint and I avoid washing the outside of my car. Nobody has tried breaking into my car yet - even when I forget to lock the doors or roll up the windows completely.

The most high-tech modification I have made was to wire up the immoboliser to an OEM-looking automotive switch that blends in on the dash in plain sight. That should deter bored kids from taking my car for a joyride, or slow down a thief if my keys get stolen.

A determined enough thief will always find a way to steal your car, imho.

**PredatorCoder** · 04-04-2006, 11:47 PM

Originally Posted by piabu

Wow! That sounds complicated.

What happens if something in the system breaks? Would that leave you stranded?

A determined enough thief will always find a way to steal your car, imho.

What if the system breaks...? Short answer, I can take apart my car and bypass the appropriate component to get it going again (a few tools hidden inside the seat should help the process). The most common thing to break I would think would be the relays. As such, the relays will be hooked to analog-to-digital converter on the relay microcontroller to verify proper operation of the relay. Thus, a broken relay can rapidly be pinpointed through the user interface, and then physically bypassed and/or replaced. If the system completely, utterly fried, crashed, and burned (unlikely since not MS Windows and i'll be bug testing each individual component for sure!) then I'd have to find each and every relay/secure switch and bypass it. Then hotwire the ignition/crank wires. Also would need to kill the alarm (if that was still working) to avoid suspicion, and disconnect the cell phone to avoid frivilous (and expensive) text messages. LOL bottom line is it better not break, that's why interaction with car PC will be limited, critical parts will be based on components rated for automotive temperature range.

Like I said - overkill for what I drive. But it's the challenge that I like. As for how a determined thief would get the car anyway - how might this be done? Describe possible attacks that would work against this system in a timely fashion (remember that the second you set my alarm off, I will get a stream of text messages giving GPS coordinates). I've thought of a few (e.g. cell phone jammer) but I'd be curious to here others. There are three goals a thief might have: (1) steal something in the car, (2) drive the car, (3) tow the car. For #1 best I can think of is use the alarms to scare them, the paging system will get my attention, and if you stick around for > 20 seconds the cameras will start to record your face. For #2... see my immobolizer/ignition scheme. For #3, only defense there is the GPS/cellular tracking system - you must shut it off before I decide to show my pretty face. And if you dump the car body somewhere... better be sure you found the hidden black box recording evidence.

**piabu** · 04-04-2006, 11:50 PM

Okay. Let us know how it turns out when you get your custom security system working.

**Mechanic** · 04-07-2006, 05:04 PM

You really only need to relay one circuit to immobilize a vehicle: the throttle position sensor (TPS) circuit. The car will still start, it just won’t go anywhere since as far as the EFI control system is concerned you are not applying any throttle.

Anytime you interfere with the fueling system such as the fuel pump circuit with the motor running, you risk the chance of leaning out the mix for a duration long enough to cause detonation. The fuel pump voltage supply is also very dependent on wire conductance, and placing a typical relay with its low rated contacts within this circuit can degrade a motors performance.

Our systems can automatically flash GM OBD-1 powertrain controllers with code that prevents the vehicle from starting, in addition to other modes such as valet, performance, economy, etc. It is impossible for anyone to physically bypass a PCM code flash.

**PredatorCoder** · 04-07-2006, 05:30 PM

Originally Posted by Mechanic

Anytime you interfere with the fueling system such as the fuel pump circuit with the motor running, you risk the chance of leaning out the mix for a duration long enough to cause detonation. The fuel pump voltage supply is also very dependent on wire conductance, and placing a typical relay with its low rated contacts within this circuit can degrade a motors performance.

Our systems can automatically flash GM OBD-1 powertrain controllers with code that prevents the vehicle from starting, in addition to other modes such as valet, performance, economy, etc. It is impossible for anyone to physically bypass a PCM code flash.

How would a cut off fuel pump be different from running out of gas in the gas tank? (Or is it not - and running out of gas causes you to risk detonation? seems like bad design).

Good idea with TPS sensor - I'll have to look into that!
I'm not sure how your typical relay is going to significantly degrade pump performance. Sure the relay has resistance, but once it's closed it's very minimal (on mine it's way way less than 1 ohm). After are, your car has a main relay on the pump as well.

I don't know what your system is, but for starters, I drive a Honda...

**Mechanic** · 04-07-2006, 05:42 PM

If you are using an automotive grade relay, you would likely not run into problems. The problem is that most folks fail to use equipment that would meet those specs. A well known performance modification for some forced induction platforms is really nothing more than replacing the stock fuel pump voltage supply circuit with heavy gauge wires and a 40 amp mil spec relay.

Running out of gas can be extremely detrimental to a motor. In addition to the possible occurence of detonation, clogged fuel filters and injectors can result from any gunk that finally makes it into the fuel lines.

I just mentioned our systems since that is what we do.. but for the record, I typically drive a Fiero Formula with a full roller aluminum head turbocharged V6 powerplant on a nice day like this.